The sequence of actions upon cookie-authentication to Drupal site

There is a drupal 9 site that has a REST-endpoint that can be accessed for logged-in users (not for anonymous ones).

And, it's necessary to make a GET request to the endpoint using cookie authentication.

Could you clarify, what the correct algorithm of this request is?

I tried to do it two ways.

Way #1.

Send a POST-request to user/login with credentials and get CSRF-token, then use the token in headers of GET-request to my endpoint. No result.

Way #2.

Send a POST-request to user/login with credentials, then send a GET-request to session/token and get token from. After that, use this token from session/token in my GET request.

Also, no result.

In both cases, it returns the 401 error (from Insomnia) or the 403 error (from external JavaScript).

My headers to GET request are

  headers: {
    'Content-Type': 'application/json',
    'X-CSRF-Token': token
  }

The cookie authentication is checked for my REST endpoint in REST UI.

What am I doing wrong?

When your endpoint requires cookie-auth, you should pass the cookie you get from your login-post with your following GET requests.

CSRF has nothing to do with auth, it's just a CSRF-attack defense.

You need to reference the stored cookie. Here's an example using curl:

curl --header "Content-type: application/json" --request POST -s -c cookie.txt --data-binary '{ "name": "username", "pass": "password" }' https://example.com/user/login

From that you will get your cookie in cookie.txt and your token in the json response.

Then you can do a get request like this (get requests don't need a CSRF token):

curl -s -X GET -b cookie.txt --header 'Content-type: application/json' ...

and a post request like this:

curl -s -X POST -b cookie.txt --header 'Content-type: application/json' --header "X-CSRF-Token: $token"